sysctl -w kernel.grsecurity.grsec_lock=1

